From e630ca5111077fa8adc972fe8a3d7e2b3e8dc91f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 27 Dec 2013 11:45:55 +0100 Subject: [PATCH] avformat/mpegts: check sl.timestamp_len Fixes: msan_uninit-mem_7ff4404547ba_4883_dmbts.ts Fixes assertion failure Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/mpegts.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 18d8d8fc11..39b1b5d552 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1256,6 +1256,11 @@ static int parse_MP4SLDescrTag(MP4DescrParseContext *d, int64_t off, int len) descr->sl.timestamp_res = avio_rb32(&d->pb); avio_rb32(&d->pb); descr->sl.timestamp_len = avio_r8(&d->pb); + if (descr->sl.timestamp_len > 64) { + avpriv_request_sample(NULL, "timestamp_len > 64"); + descr->sl.timestamp_len = 64; + return AVERROR_PATCHWELCOME; + } descr->sl.ocr_len = avio_r8(&d->pb); descr->sl.au_len = avio_r8(&d->pb); descr->sl.inst_bitrate_len = avio_r8(&d->pb);